Module canonical 

Canonicalization: the deterministic normal form of a module.

Two modules that are logically equal must produce identical bytes and an identical content hash, no matter how they were built. Canonicalization therefore does all of the following, in one pass, before a single byte is written:

1. drops nodes unreachable from the module roots (root, bindings, annotation subjects and their constraint expressions) — an image can never hide data in an unreferenced node;
2. numbers nodes in pre-order from the roots, visiting table fields in key order, so arena construction order is irrelevant;
3. sorts table fields, strings, units, types, blobs, hashes, numbers, annotations, provenance entries, extension blocks and edges;
4. normalizes floats (-0.0 → +0.0, NaN → one quiet NaN);
5. deduplicates strings, units, types, blobs, hashes, numbers and edges.

Secret literals are ordered by node order and never deduplicated: two identical secrets still occupy two table entries so that table length and layout cannot become an equality oracle.

Constants

SECRET_MARKER

Marker substituted for secret material in every projection and in metadata that is copied verbatim into exports.